AI0-001 Practice Test 21 — 15 Questions

Question 1

A security engineer is hardening an LLM application against indirect prompt injection attacks. Which TWO controls are MOST effective? (Select two.)

Accepted Answer

Output filtering. Input validation and sanitization can filter malicious content in retrieved data, and output filtering can prevent the model from executing injected instructions. Both are key defenses.

Answer

Rate limiting

Answer

Differential privacy

Answer

Federated learning

Question 2

During a security audit of an AI-powered code generation tool, the audit team discovers that the system prompt (which contains sensitive internal instructions) can be leaked through carefully crafted user inputs. Which THREE OWASP LLM Top 10 categories are MOST directly relevant to this finding?

Accepted Answer

Prompt injection. Prompt injection (direct or indirect) is the attack vector that causes the system prompt leak. Sensitive information disclosure is the consequence. Insecure output handling can also be relevant if the leak is due to improper output management. Model denial of service, supply chain vulnerabilities, and training data poisoning are not directly related to prompt leaking.

Answer

Model denial of service

Answer

Supply chain vulnerabilities

Question 3

An organization wants to train a machine learning model on sensitive patient data without exposing individual records. Which privacy-preserving technique allows the model to learn from data distributed across multiple hospitals without raw data leaving each site?

Accepted Answer

Federated learning. Federated learning trains models locally at each site and only shares model updates, not raw data. Differential privacy adds noise, homomorphic encryption allows computation on encrypted data, and k-anonymity is a data anonymization technique.

Answer

Homomorphic encryption

Answer

k-anonymity

Answer

Differential privacy

Question 4

During a security review, an auditor finds that an LLM application can call external functions (e.g., send emails, update databases) based on user prompts. Which risk is MOST concerning?

Accepted Answer

Excessive agency. Excessive agency allows the LLM to perform unintended actions with real-world consequences, such as sending emails or modifying data.

Answer

Prompt injection

Answer

Model denial of service

Answer

Hallucinations producing dangerous advice

Question 5

A company is developing an AI-powered recruitment tool. To prevent bias and ensure fairness, they want to audit the model's training data and outputs. Which TWO practices should they implement as part of secure AI development?

Accepted Answer

Threat modeling using STRIDE for AI-specific threats. Threat modeling for AI systems helps identify bias-related threats, and access controls on training data prevent unauthorized modifications that could introduce bias. Both are part of secure AI development practices.

Answer

Enabling model parallelism

Answer

Increasing the model's learning rate

Answer

Using a larger batch size

Question 6

A security analyst discovers that an attacker has been querying a production LLM API with thousands of carefully crafted prompts and using the responses to build a local copy of the model. Which attack is occurring?

Accepted Answer

Model extraction. Model extraction attacks involve querying a model to reconstruct its functionality or parameters. Membership inference determines if data was in training, data poisoning corrupts training, and prompt injection manipulates prompts.

Answer

Prompt injection

Answer

Data poisoning

Answer

Membership inference

Question 7

A company uses a third-party pre-trained language model for a sentiment analysis API. They want to ensure the model has not been backdoored. Which supply chain security practice is MOST effective?

Accepted Answer

Obtain and verify a Software Bill of Materials (SBOM) for the model. A Software Bill of Materials (SBOM) lists all components and dependencies, enabling verification of the model's origin and integrity. The other options are less relevant for detecting backdoors.

Answer

Monitor API usage for anomalous patterns

Answer

Use federated learning to train the model

Answer

Implement differential privacy during training

Question 8

A financial institution is developing a fraud detection model using historical transaction data. The dataset contains over 10 million records, but only 0.01% of transactions are fraudulent. The current model uses a neural network trained with standard cross-entropy loss, and the team applies random undersampling of the majority class to create a balanced training set. However, the model still produces a high number of false positives (legitimate transactions flagged as fraud) and misses approximately 30% of actual fraud cases. The business requires that at least 95% of frauds be caught, and the false positive rate must be below 1% to avoid overwhelming fraud analysts. The team has limited resources to collect additional data and cannot change the model architecture significantly. Which approach should the team take to best meet the business requirements?

Accepted Answer

Use cost-sensitive learning by assigning a higher misclassification cost to the fraud class.. Cost-sensitive learning adjusts the loss function to penalize false negatives more heavily, directly addressing the need to catch more frauds while controlling false positives. Collecting more data is impractical and may not resolve the imbalance. Anomaly detection models treat fraud as outliers but often have high false positive rates in this context. Feature selection does not inherently solve the imbalance or performance metric trade-off.

Answer

Apply feature selection to remove noisy predictors and then retrain the current model.

Answer

Switch to an anomaly detection algorithm such as Isolation Forest or One-Class SVM.

Answer

Collect more transaction data, especially fraudulent examples, to naturally balance the classes.

Question 9

A company is adopting a secure development lifecycle for its new AI product. Which THREE activities are essential for secure AI development? (Select three.)

Accepted Answer

Implementing secure data pipelines. Threat modeling identifies risks, secure data pipelines prevent data poisoning, and audit logging provides traceability. These cover design, data, and operations.

Answer

Deploying the model on the fastest hardware available

Answer

Using homomorphic encryption for all data at rest

Question 10

A developer is integrating an LLM API into a customer-facing application. They want to prevent unauthorized third parties from using the API key. Which of the following is the BEST approach?

Accepted Answer

Use environment variables to store the API key and implement least-privilege access controls on the server side. Using environment variables (or secrets management) and enforcing least-privilege API access, combined with key rotation, is the best practice. Hardcoding is insecure, rate limiting doesn't prevent key theft, and client-side embedding exposes the key.

Answer

Embed the API key in the client-side JavaScript and rely on CORS policies

Answer

Store the API key in the application's source code and use version control to track changes

Answer

Apply rate limiting to the API endpoint to prevent excessive usage

Question 11

A company is developing a chatbot that helps users write code. They are concerned about the chatbot being used to generate malicious code. Which defense should they implement to reduce this risk?

Accepted Answer

Output filtering and guardrails to detect malicious code patterns. Output filtering and guardrails can detect and block malicious code generation. Input validation helps but the risk is in the output. Red teaming is testing, and data poisoning is a different attack vector.

Answer

Input validation to block special characters

Answer

Data poisoning prevention during training

Answer

Red teaming the model before deployment

Question 12

Refer to the exhibit. A team deploys a sentiment analysis model with this policy. After one month, the monitoring system triggers an alert for feature drift. Which action should the team take first?

Accepted Answer

Compare the current feature distributions with the training set to identify which features drifted.. When a monitoring system triggers an alert for feature drift, the first step is to diagnose which features have changed. Comparing current feature distributions with the training set identifies the specific features that drifted, enabling targeted remediation such as retraining with recent data or feature engineering. This aligns with the standard MLOps workflow for drift detection and response.

Answer

Review the fairness check settings to ensure protected attributes are still relevant.

Answer

Immediately retrain the model on recent data to adapt to the drift.

Answer

Reduce the classification threshold to 0.5 to increase sensitivity.

Question 13

A company is deploying an AI system that falls under the EU AI Act's high-risk category. Which THREE requirements must the company fulfill?

Accepted Answer

Ensure human oversight to prevent or minimise risks. The EU AI Act for high-risk systems requires risk management, human oversight, and transparency documentation. Open-sourcing the model is not required; obtaining consent is not a specific requirement for high-risk systems.

Answer

Obtain explicit consent from all affected individuals

Answer

Open-source the model's code to the public

Question 14

A data analyst is cleaning a dataset and finds that 20% of the values for the 'age' column are missing. Which imputation method is most robust if the data is not normally distributed?

Accepted Answer

Median imputation. Median imputation is the most robust method for handling missing values in the 'age' column when the data is not normally distributed because the median is unaffected by outliers or skewness. Unlike the mean, which is sensitive to extreme values, the median provides a central tendency measure that better represents the typical value in non-normal distributions, preserving the dataset's integrity for downstream modeling.

Answer

Mean imputation

Answer

Mode imputation

Answer

Remove rows with missing values

Question 15

A data scientist needs to explain why a specific loan application was rejected by a tree-based model. The model is complex and not inherently interpretable. Which method should the data scientist use to provide a local explanation for this single prediction?

Accepted Answer

LIME. LIME (Local Interpretable Model-agnostic Explanations) is the correct choice because it is specifically designed to provide local explanations for individual predictions by approximating the complex model with a simpler, interpretable surrogate model around that specific instance. For a tree-based model that is not inherently interpretable, LIME can explain why a single loan application was rejected by perturbing the input and observing the changes in predictions, making it ideal for this use case.

Answer

SHAP values

Answer

Model cards

Answer

Attention visualization